Duplicate requests dependency (causes issues on Python 2)

[jleclanche]

After the stripe-python 2.0 upgrade, dj-stripe's tests on Python 2.7 started failing and I've been trying to investigate why. The error is a little absurd:

Traceback (most recent call last):
  File "runtests.py", line 210, in <module>
    main()
  File "runtests.py", line 27, in main
    run_test_suite(args)
  File "runtests.py", line 152, in run_test_suite
    django.setup()
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/__init__.py", line 27, in setup
    apps.populate(settings.INSTALLED_APPS)
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/apps/registry.py", line 85, in populate
    app_config = AppConfig.create(entry)
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/django/apps/config.py", line 94, in create
    module = import_module(entry)
  File "/usr/lib64/python2.7/importlib/__init__.py", line 37, in import_module
    __import__(name)
  File "/home/adys/src/HearthSim/dj-stripe/djstripe/__init__.py", line 12, in <module>
    __version__ = pkg_resources.require("dj-stripe")[0].version
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/pkg_resources/__init__.py", line 891, in require
    needed = self.resolve(parse_requirements(requirements))
  File "/home/adys/src/HearthSim/dj-stripe/.tox/py27-django111/lib/python2.7/site-packages/pkg_resources/__init__.py", line 777, in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'cryptography>=1.3.4; extra == "security"' distribution was not found and is required by requests

Using pipdeptree however, we can see that stripe specifies the requests dependency twice:

  - stripe [required: >=1.53.0, installed: 2.0.1]
    - requests [required: >=2, installed: 2.19.1]
      - certifi [required: >=2017.4.17, installed: 2018.4.16]
      - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
      - idna [required: >=2.5,<2.8, installed: 2.7]
      - urllib3 [required: >=1.21.1,<1.24, installed: 1.23]
    - requests [required: >=2, installed: 2.19.1]
      - certifi [required: >=2017.4.17, installed: 2018.4.16]
      - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
      - idna [required: >=2.5,<2.8, installed: 2.7]
      - urllib3 [required: >=1.21.1,<1.24, installed: 1.23]

Currently, setup.py defines requests twice as a dependency. Once plain, once with the [security] extra package.

With this information, I found a relevant upstream pip bug: pypa/pip#4957

The duplicate-dependency issue is easily worked around by making plain requests only a dependency on python_version >= 3.0. I believe this will fix the resulting issue as well. I'll file a PR.